An Analysis of McDonnell Douglass Ethical Responsibility in the Crash of Turkish Airlines Flight 981

The Memorial of Flight 981 at Ermenonville (Johnston, 1976). Executive Summary

In 1974, Turkish Airlines Flight 981 experienced a mid-flight cargo door failure which led to the first total loss of a wide-bodied aircraft in history. The aircraft was a McDonnell Douglas DC-10, and this tragedy was compounded by the fact that sufficient corrective action had not been taken by the manufacturer after precursory failures had occurred over the four previous years. The purpose of this report is to evaluate the ethical nature of McDonnell Douglass decisions throughout this crisis, discerning their priorities with regard to safety and financial gain, and to assess if these qualities have changed in response. The origin of this catastrophe lay in a poor handling of design and manufacturing. The cargo doors design employed faulty philosophies, and decisions regarding its manufacture were driven by savings at the expense of safety. However, though the doors faults were later exposed, a more serious problem involving the tail control lines in the passenger floor was continually overlooked until the crash. This was due primarily to a policy of using old design strategies which met minimum federal requirements. The company oversimplified the control lines failure mode when confronted with it in ground testing and, being committed to their own design, were unable to recognize the root problem. In 1972, after the commercial release of the DC-10, a mid-flight incident occurred which exhibited the exact same failure mode. Federal government agencies investigated the incident and concluded that the aircraft required modifications before it would be safe for flight. Due to the damage that the federal mandates could inflict upon McDonnell Douglass global sales effort, the company struck up a Gentlemens Agreement with the Federal Aviation Administration in which they promised to handle the problem themselves. However, the modifications were then handled clumsily, resulting in the crash of Flight 981. In all likelihood, what allowed the company management to accept this risk in safety was the miscommunication of the gravity of the flaws, and so they acted to preserve the reputation of their new aircraft. There can be no doubt that their engineers had sufficient technical indication of such a crash, but they were unable to recognize the implications. Unfortunately, the opinions of the fuselage contractors engineers, those who knew the problem best, were essentially squelched due to closed lines of communication between Douglas and their contractor. Thus, due to the intense competition within the industry, the managers were willing to employ ethically questionable tactics of undermining the FAAs procedures and playing down the seriousness of the design flaws in order to save themselves financially. Following the crash of Flight 981, McDonnell Douglas quickly implemented the originally-promised modifications in order to adhere with new regulations. However, in the subsequent investigation, the company did not recognize their primary liability and attempted to pin it on virtually every other involved party. Unfortunately, this issue of liability was never legally resolved because the same insurance group would incur the costs no matter who was at fault. Thus the accident occurred and passed without absolute resolution, a deficiency which may have paved the way for the future accidents which continued to plague the career of the DC-10. As a case study, the story of Turkish Airlines Flight 981 stands as a classic example of the complex nature of most applications of ethics in engineering, for though McDonnell Douglas handled a challenge in what it perceived to be a fair manner, the companys lack of total focus on safety and ethics resulted in the death of hundreds. Thus this study finds that although the crisis involved many private and public factors, McDonnell Douglas bears primary responsibility for the disaster. Through its poor production stages, McDonnell Douglas may be considered entirely responsible for allowing their defective product to reach the market. However, the companys most crucial fault lay in that they were not ethically conscientious at every decision-making level throughout the life of their product.

Introduction The airline industry is a dominant force in modern transportation. In the last forty years, the world has witnessed as commercial flight has swiftly expanded in both short- and longdistance markets, regularly placing the lives of countless passengers in the hands of aircraft manufacturers. The advent of the jumbo jet carried with it an inherent fear of the massive loss of human life that would occur with virtually any mid-flight failure, and thus also an increased responsibility for conscientious design and ethical practices. In 1974, the worst fears were realized when Turkish Airlines Flight 981, a McDonnell Douglas DC-10 aircraft, crashed in northern France and became the first catastrophic wide-bodied commercial aircraft accident (Schlager, 1994, p. 52). The McDonnell Douglas Corporation had originated as two separate aeronautics companies which each produced small propeller-driven and jet-powered planes for the US military. In the early 1960s, Douglas Aircraft decided to try to enter the newly booming commercial aircraft market (Francillion, 1990). This industry was both highly risky and fiercely competitive, led by Boeing with their development of the first ever wide-bodied jumbo jet, the 747 (Newhouse, 1982, p. 55). In an effort to keep up, Douglas developed the DC-8 and DC-9, but fell upon financial difficulties when they were unable to meet their scheduled delivery dates. Thus in 1967, McDonnell Aircraft purchased the floundering Douglas Company and became the McDonnell Douglas Corporation. With the commercial aircraft background of Douglas and the abundant capital of McDonnell, the new company was able to establish a foothold in the commercial market with the development of the DC-10, the second wide-bodied jet in history (Francillion, 1990). On March 3, 1974, Turkish Airlines Flight 981, a DC-10 out of Paris (see Fig. 1), experienced explosive decompression ten minutes after take-off when the rear cargo door burst open. The cargo area evacuated, and the floor of the passenger area, which separated the cabin from the lower cargo hold, buckled under the enormous pressure differential. As a result, the hydraulic control lines that ran under this floor to the tail of the craft were severed, and witnesses watched as the nonresponsive plane plummeted at nearly 500 mph into the Ermenonville forest outside Paris, killing all 346 people onboard (Schlager, 1994). Figure 2 shows the horrifying scene left behind. Prior to this crash, the DC-10 design had experienced similar failure when cargo doors blew off both in 1970 during a ground test and later in 1972 on an American Airlines flight over Windsor, Ontario. Following both incidents, investigators largely concluded that the door had been improperly locked so no major modifications were made to the doors, only small Band-Aid fixes (Unger, 1982).

Figure 1: Turkish Airlines (THY) Flight 981 (Eddy et al., 1976).

Figure 2: The wreckage of Flight 981 in the Ermenonville forest, March 3, 1974 (Eddy et al., 1976). The 1974 crash is significant because it occurred at a critical time in history for both the airline industry and McDonnell Douglas. That decade saw the birth of modern air travel as jumbo jets increased capacity and range allowed airlines to provide international travel at lower costs to both consumers and themselves. A few large companies, including McDonnell Douglas, were therefore trying to establish reputations for reliability and gain a piece of this emerging market. The crash was increasingly devastating because it was the first total loss of a wide-bodied airliner, an event that was feared since their inception (Schlager, 1994, p. 52). The crash of Flight 981 is worth further examination because it is an excellent case study of how safety and ethics can be compromised. McDonnell Douglas overlooked incidents that indicated a potentially fatal safety problem, and the penalty was the loss of hundreds of lives and the beginnings of a marred reputation for the companys newest, yet largest, investment. The lessons that McDonnell Douglas learned from this disaster are readily applicable today. Due to present struggles to pull a profit, the airline industry is as competitive as ever, requiring constant improvement of old designs and adaptation to new designs (Sharkey, 2001). This constant flux spells a higher urgency than ever for companies that develop and manufacture aircraft to remain focused on safety and ethical practices. The purpose of this report is to evaluate the ethical nature of McDonnell Douglass decisions, discerning their priorities with regard to safety and financial gain, and to assess how these qualities have changed in response. This will be accomplished by investigating into McDonnell Douglass industrial processes, reactions to the crisis, and overall policies in place

at the time of the accident. The study begins with a look at the companys design and manufacturing processes as they pertained to developing the cargo door, including a technical look at the features and flaws in the door, delegation of the work, and ground testing practices. Next, we will examine McDonnell Douglass response to the mid-flight incident of 1972 and to the opinions of the involved engineers. In addition, we will discuss the circumstances and ethics of McDonnell Douglass recourse to gradually install modifications. Finally, the focus will shift to an analysis of the responsibility assumed by the company, looking specifically at their cleanup actions and public statements.

McDonnell Douglas's Design, Manufacturing, and Testing Policies Design Philosophy and Failure of the Cargo Door The cargo door was the component of the DC-10 aircraft whose failure ultimately led to loss of control of the plane. A failure sequence observed both in the prior incidents and the crash was triggered by an inadequate closure of this door each time. In order to gain a perspective on McDonnell Douglass policies of safety in design, we begin with an analysis of the door and an examination of the design philosophies employed and their implications as they pertained to the crash of Flight 981. On any aircraft, the integrity of each door is vital to maintaining cabin pressure so that passengers may breathe at the high cruising altitudes of long-range airliners. On the DC-10, however, the criticality of a sound design for the cargo door is increased due to the design of the planes control system. Three independent systems of hydraulic and electrical lines, which allow the cockpit to control the tail, run through the passenger floor that separates the cabin from the cargo hold. A door failure at high altitudes would cause depressurization of the cargo area and a large pressure differential across the cabin floor. The floor, an open truss arrangement not intended to hold this pressure, would then collapse, severing the hydraulic lines which control the tail. This would result in a complete loss of the planes pitch control, and the front-heavy mass distribution of the aircraft would cause it to pitch forward naturally into a nose-dive. This fatal sequence is in addition to any damage to the fuselage as the door is ripped away as well as subsequent damage to the tail from the door or any ejected cargo (Fielder, 1992, pp. 71-72). Passenger doors on every airplane are plug type (inward-opening), and so while inflight, the cabin pressure aids in keeping the door sealed shut. However, a cargo door is large and cannot be made this way due to interior space issues. Thus it is common practice for the doors to be designed to hinge outward with a series of latches, or hooks, which rotate around a latch spool and use the interior pressure to hold the door tightly in place (see Fig. 3). This rotation is driven by an actuator which moves the latches into place through a linkage. The rotation is completed when the linkage passes over center, thereby causing the pressure forces conducted through the latches to keep the door shut. As an additional measure, locking pins then move into place which prevent backward movement of the linkage (see Fig. 4-a). Finally, a small vent door is installed as a visual indicator of proper closure such that it only closes once the lock pins are in place, allowing the cargo hold to pressurize (see Fig. 5-a). This door is closed by turning the external handle (Fielder, 1992, pp. 72-73).

Figure 3: The rear cargo door on the DC-10. (Fielder et al., 1992).

(a) (b) Figure 4: The latch linkage in (a) the correct, over center position, and (b) the false closure position (Eddy et al., 1976).

(a) (b) Figure 5: Different latch and vent door designs: (a) the coincidental design utilized by McDonnell Douglas, and (b) the consequential design used by competitors (Eddy et al., 1976). Considering the failure modes of different types of actuators, the choice of the DC-10s actuator was one which may have unnecessarily invited disaster. The actuators driving force could either be hydraulic or electric. A hydraulic actuator constantly applies pressure and, in the event of an improper closure, would fail by moving when the cargo pressure forces offset the actuator force. Such a choice would provide for soft failure at an altitude low enough for the resulting differential across the cabin floor to be too small to buckle the structure. In contrast, the electric actuator turns off after use and hard ratchets hold its position, failing only once large enough pressure forces break the ratchet material. These forces are achievable only at altitudes high enough that would doom the entire aircraft. McDonnell Douglas originally set out to design the DC-10 door using a hydraulic actuator, but they traded it for an electric actuator at the request of American Airlines due to the latters lower maintenance and weight costs (Fielder, 1992, pp. 76-77). The design of the DC-10s vent door was such that it did not properly indicate a successful locking of the cargo door. Figure 5 shows the design utilized by McDonnell Douglas as opposed to that employed by their competitors, Boeing and Lockheed Martin. The connection of the vent door to the handle as opposed to the other side of the locking pins makes its sealing a coincidental rather than consequential event. Indeed, it turned out to be

readily possible to bend the linkage torque bar such that the linkage would not reach the over center position (see Figs. 4-b and 6), and when the locking pins subsequently jammed, the operator was still able to close the vent door by forcing the cargo door handle into place (Fielder, 1992, pp. 77-78).

Figure 6: The torque bar failure (Eddy et al., 1976). All design issues involved with the cargo door, however, are the means by which another root cause of the loss of the plane is exposed: the arrangement of the hydraulic control lines. The DC-10 was equipped with three independent sets of control lines running through the cabin floor that all severed as the floor collapsed. This number was the minimum requirement from the Federal Aviation Administration (FAA), and it was the same number which had been

put in the floors of smaller Douglas craft in previous years, all of which had narrower and thus inherently stronger floors. Interpreting the cause of this, Peter French blames their company policy of technological caution on the companys financial problems encountered early on due to the rigorous competition, a policy which encouraged that corners be cut and existing Douglas technology be used even if inferior to competitors updated designs (1982, p. 184). Indeed, at the time, the companys competitors each had four sets of lines, and thus one more degree of redundancy (French, 1982, p. 185). Though critics have identified this as shortsightedness on the part of the companys engineers (French, 1982, p. 185), Homer Sewell argues that the number of control systems is a moot point if they are all placed within the collapsing passenger floor. Instead, McDonnell Douglass fault lay primarily in the fact that one set of lines was not incorporated into the passenger ceiling, a practice again employed by their competitors (Sewell, 1982, p. 197). McDonnell Douglass Relationship with Convair While McDonnell Douglas was still working on the design of the DC-10, they began sending out Bid Documents to subcontractors for the detailed design and manufacturing of the fuselage. In 1968, Douglas awarded Convair, a division of General Dynamics, the contract to build the fuselage, including the cargo doors. The relationship between Convair and McDonnell Douglas during this time was perhaps slightly more autocratic than is standard with contractors. The engineers working for Convair were given explicit instructions about every aspect of development, and Douglass requirements included plug passenger doors, lower outward-opening tension-latched cargo doors driven by hydraulic cylinders, and a standing request to save weight wherever possible. Douglas believed their design specifications to be adequate, and little latitude was given to the engineers working for Convair. Furthermore, the contract with Douglas forbade Convair from contacting the FAA over any issue (Eddy et al., 1976, pp. 175-177, 179). The business of aircraft subcontracting was also quite competitive, leaving companies like Convair content with keeping their contract. Company Failures in the Ground Testing Incident of 1970 In May 1970, the first DC-10 was assembled at a plant in Long Beach and underwent ground tests in preparation for its maiden flight in August (Eddy et al., 1976, p. 179). During one of these ground tests, as the fuselage was being pressurized to test the air conditioning system, the rear cargo door flew open, resulting in a rapid depressurization of the cargo compartment. Instantly, the pressure in the cabin caused the passenger floor to buckle, collapsing into the cargo hold and severing all hydraulic flight control lines (Vesilind, 2001, pp. 184-185). Had this type of event occurred during an actual flight, the pilot would have been left with only minor control of the plane, leaving the passengers with little hope of survival. However, the investigation that followed looked into only the failure of the rear cargo door, and neglected the placement of the hydraulic lines in the passenger floor. The McDonnell Douglas investigators came to the conclusion that the door was simply not properly locked in place and that it was extremely unlikely that the incident would be repeated (Vesilind, 2001). The failure was blamed on the mechanic who had improperly closed the door (Eddy et al., 1976, p. 179). The end result was a series of small fixes that did not significantly improve the door-latching mechanism (Unger, 1982, p. 11). This included most notably the addition of the vent door, a small plug-door set within the main door (Eddy et al., 1976, p. 179). During their certification process which followed it would seem that such a critical

weakness of the cargo door would have been found by the FAA. However, it is important to note that the FAA certification process suffers from a fundamental weakness: much of the work involved during certification testing is actually done by the manufacturers themselves in the name of the FAA (Eddy et al., 1976, p. 180). Because the FAA lacks the manpower and in some cases the expertise to inspect every aspect of an airliner, it appoints designated engineering representatives (DERs). In this instance, these men were paid by McDonnell Douglas, but spent a part of their working lives wearing an FAA hat (Eddy et al., 1976, p. 180). It was this persons job to ensure that all aspects of the plane complied with the FAAs Federal Airworthiness Regulations (FAR). In the case of the DC-10, only one fourth of the inspections were carried out by FAA personnel; the rest were performed by McDonnell Douglas DERs (Eddy et al., 1976, p. 180). It is easy to imagine a conflict of interest arising from such a situation. Just as Robert Lund was told to put on his managers hat before deciding to support the launch of the Challenger space shuttle in 1986, an engineer working for McDonnell Douglas would be influenced by what his company demands while doing what he believed to be right based on FAA regulations. The failure to catch the problem with the cargo door of the DC-10 is a classic example of how mistakes can be overlooked when manufacturers are given the opportunity to police themselves (Eddy et al., 1976, p. 180). Overall, in most cases airplane malfunctions are not discovered until after a major incident occurs; however, in this instance McDonnell Douglas was presented with a problem in their design well before any person ever stepped onboard a DC-10. The fact that the problem with the cargo door and the hydraulic lines was not given the proper amount of concern indicates that McDonnell Douglas lost sight of the first responsibility of an engineer, which Unger describes as tak[ing] responsibility for the consequences of their work and play[ing] an active role in directing it toward human ends (Unger, 1982, ix). On July 29, 1971, actual FAA personnel certificated the DC-10 for commercial flight (Eddy et al., 1976, p. 182).

McDonnell Douglas's Response to Precursors of Disaster The Windsor Incident of 1972 Following the manufacturing and sale of the first part of the DC-10 fleet McDonnell Douglas received another warning of disaster in what is now known as the Windsor Incident. On June 12, 1972 American Airlines Flight 96, a DC-10, departed from Detroit (Johnston, 1976, p. 39). Prior to take-off, the last compartment to be secured was the rear cargo compartment. However, the cargo handler found it difficult to lock the rear cargo door completely in that once he closed the door with the electrical actuators he had trouble locking the exterior handle that moves the lock pins into place. He then applied additional force with his knee, which closed the handle and caused the vent door to move into its proper position. Unfortunately, the torque bar bent and the latches never reached their over center position, meaning the door was never properly locked (Fielder et al., 1992, pp. 94-95). At an altitude of 11,750 feet, this rear cargo compartment door separated from the plane in flight. The rapid decompression that followed caused the floor to partially collapse into the cargo compartment, breaking various hydraulic control cables that were routed through the floor beams to the rear control system. The National Transportation and Safety Board (NTSB) report on the Windsor Incident notes that this cabin floor was not equipped with pressure relief vents that could prevent the floor from buckling (Fielder et al., 1992, pp. 94-97). Figure 7 displays the power of the explosive decompression experienced by the Windsor aircraft.

Figure 7: The remains of the cargo door after the Windsor Incident (Eddy et al., 1976). Fortunately for the passengers and crew, they had two circumstances working in their favor. First, the plane was very lightly loaded, for there were only a total of sixty-seven people onboard, and the result was that the floor of the passenger compartment only partially collapsed and did not sever all three hydraulic lines (Fielder et al., 1992, p. 97). Second, Captain Bryce McCormick was astonishingly prepared. Based on amazing foresight, McCormick spent a great deal of time using simulators to learn how to fly a plane using only the wing engines and control surfaces in case he ever lost the rear hydraulic controls. Therefore, when the events of June 12 left McCormick with little hydraulic control, he was able to stabilize the aircraft and return to Detroit where he successfully landed the disabled craft without any loss of life (Unger, 1982, p. 10). In this instance disaster was avoided through amazing skill and a little bit of luck, but even this near miss would not give McDonnell Douglas the stimulus it needed to realize the major shortcomings of the cargo door design (Unger, 1982, p. 10). The Engineers Opinions Before any conclusions may be drawn regarding the companys reactions to events such as the ground test and Windsor incidents, it is necessary to first examine the technical feedback offered to McDonnell Douglass management from engineers internal to the manufacturing process. Early indication of engineers misgivings about the safety issues involved with the crash of Flight 981 extends back to 1969, when Douglas requested that Convair draft a Failure Mode and Effects Analysis (FMEA) for the cargo door locking system. For this document, Douglas instructed that no great reliance was to be given to warning lights on the flight deck, and even less reliance should be placed on warning systems which relied on the alertness on ground crews (Eddy et al., 1976, pp. 177-178). The resulting study identified nine possible sequences that could produce a life-threatening situation, including the exact sequences which occurred both in the Windsor Incident and on Flight 981. However, this report was never shown to the FAA by Douglas, nor could Convair contact the agency by terms of their contract. Indeed, the FMEAs later submitted to the FAA by McDonnell Douglas for certification of the DC-10 made no mention of malfunctions of lower cargo doors

(Eddy et al., 1976, p. 179). In addition to this early warning from the engineers involved in the doors detailed design, following the ground test failure in 1970, Convair was able to obtain schematics of Boeings door design which utilized proper design philosophies on the vent door and linkages. The sharing of this type of information on safety systems is fairly common in the commercial aviation industry, and an engineer from Convair who worked closely with the Douglas design team recorded in a memo several ways to avoid the potential problem of depressurization, including all the major recommendations that would come from the government following the Windsor Incident (Eddy et al., 1976, p. 181). The most famous event pertaining to the Turkish Airlines crash, however, involved a memorandum written immediately after the Windsor Incident by Daniel Applegate, who was chief product engineer for Convair and thus in charge of the cargo doors design (Vesilind, 2001, p. 185). In this formal appeal to his management, he urged that McDonnell Douglas be approached about the door, following historically their decisions which gradually degraded the doors safety systems and citing Murphys Law as a reminder that the problem would not lie hidden forever. In powerful language, he asserted his certainty of his companys precarious position, saying It seems to me inevitable that, in the twenty years ahead of us, DC-10 cargo doors will come open and I would expect this to usually result in the loss of the airplane (Eddy et al., 1976, pp. 182-185). However, his superiors believed that this action might damage Convairs relationship with McDonnell Douglas, and they did not pursue the matter any further (Vesilind, 2001, p. 186). Applegates failure to act following the hushing of his memo has, through many academic discussions on an ethical obligation to blow the whistle, earned him partial blame for this catastrophe. One argument is that he was ethically obligated because he did not exhaust resources external to his company, such as the media or a legislator, through which his voice might have been heard (Birsch, 1992, pp. 172-174). Another point of view which partially absolves him in light of his failure is that as an engineer he simply did not possess the necessary social skills required by this complex of a situation (Vesilind, 2001, pp. 186187). However, a closer inspection of his companys motivations reveals the root cause of ethically mishandling this information to lie with McDonnell Douglas in a manner similar to how the faulty door designs ultimately exposed the placement of the control lines to be the technical root cause of the disaster. Following the ground test failure of the cargo door and subsequent passenger floor collapse, Douglas accused Convair of producing a defective floor, requiring that they be financially responsible for its repair (Eddy et al., 1976, p. 182). In fact, Applegates memo was written not purely on the grounds of safety, but in anticipation of accident liability being shifted to Convair in the future. Therein, he summarized his companys concern that Douglas would attempt to shift the responsibility for these kinds of conceptual system decisions to Convair as they appear to be now doing in our change negotiations, since we did not then nor at any later date have any voice in such decisions (Eddy et al., 1976, p. 183). In addition, in light of the submitted FMEA and three years of closely working with McDonnell Douglas engineers, members of his management had to admit that most of the statements made by Applegate were considered to be well-known to Douglas and there was nothing new in them that was not known to Douglas (Eddy et al., 1976, p. 183). Further pursuit of this matter would not introduce any new information, yet might unnecessarily invite more criticism and issues of liability onto the company. Thus, in fully pardoning Applegates lack of follow-through, Eddy et al. assess that Convairs experience over the previous three years had led to the belief that to raise such major safety questions with Douglas was chiefly to give away points in an ongoing financial contest with competing subcontractors (1976, p. 185). As long as the plane met federal regulations, Convair need not risk endangering its own contract. While they were clearly at fault on the

surface, the silencing of this expert opinion may be accredited to McDonnell Douglass closed lines of communication with its own subcontractor regarding safety recommendations and financial tension. NTSBs Recommendations and the Gentlemens Agreement with the FAA Following the incident involving the American Airlines flight over Windsor, the National Transportation Safety Board immediately began an investigation of the cargo door failure. After some prodding, Douglas submitted some one hundred reports of problems with doors from airliners, information which at that time was sent to the manufacturers rather than the safety bureaus and which was unknown to the FAA and the NTSB up to that point. They also submitted their plan to address these problems by rewiring the doors to increase actuator power (Eddy et al., 1976, pp. 151-152). Conducting its analysis, the NTSB recommended that modifications be made to the doors to make it physically impossible to seal the vent door unless locking pins were in place, and also to install relief vents in the cabin floor to prevent pressure from collapsing it in the event of a blowout (Fielder et al., 1992, p. 99). These modifications were to be designated in a formal Airworthiness Directive (AD), which would have the full force of the law behind it in order to encourage a timely response. However, before the AD was issued, Douglas president Jackson McGowen worked out a Gentlemans Agreement with FAA Administrator John Shaffer by which McGowen promised to fix the problems with the cargo door and Shaffer agreed to have the modifications mandated by routine service bulletins, which posed essentially a less severe call to action (Eddy et al., 1976, pp. 153). The proposed modifications included the installation of a peephole through which a baggage handler could visually confirm proper position of the locking pins and a support plate for the torque tube attached to the handle which was susceptible to bending and would then falsely allow the vent door to close (see item 9 in Fig. 5-a) (Fielder, 1992, pp. 78). These fixes, while avoiding the primary problem of the collapsing floor and subsequent severing of the hydraulic lines, might have proved sufficient if they had been properly carried out. Due to the routine nature of the service bulletins, implementation of these modifications was relatively sluggish (Eddy et al., 1976, pp. 157). On the DC-10 that ultimately became Turkish Airlines Flight 981, it turned out that the support plate had never been installed, essentially dooming the aircraft to the same plight experienced over the previous years. A discrepancy in McDonnell Douglass quality control system was later exposed when it was found that three inspectors falsely certified the modification with their stamp though none could remember it (French, 1982, p. 188). This event seems consistent with the inherent ground testing and certification conflicts of interest already discussed, a fault attributed largely to the FAAs lack of manpower. However, an alternative viewpoint is to shift primary responsibility for this to McDonnell Douglas, and in his essay, Peter French instead exposes and criticizes the regularity and listlessness of their corporate policies, stating that the inspection procedure invites or tempts inspectors to be lax and careless (1982, p. 188). To be sure, a good deal of blame for this failure to correct fundamental errors may well be assigned to the FAA. The fault extends all the way to the principles on which the agency was founded, for in addition to upholding safety, a primary goal of the FAA was to promote commercial success in the aviation industry. Its head, Shaffer, was a man with experience in both the administrative and commercial arenas, and as such was an embodiment of both ideals. Indeed, shortly after his appointment he began to turn down AD recommendations from the NTSB in smaller-profile cases in order to prevent the crippling of smaller plane manufacturers (Eddy et al., 1976, pp. 143-144). In addition, for reasons too complicated to enumerate here, the head of the NTSB was at the time fighting against what he saw as a

direct political attack, and subsequently he was too preoccupied even to realize that the NTSBs recommendations about the DC-10 were largely disregarded by the FAA and McDonnell Douglas and therefore did not pursue the issue too fervently (Eddy et al., 1976, pp. 151). These internal problems contributed to the FAAs ignorance of the full implications of the signs which warned against disaster. However, consideration of McDonnell Douglass financial stakes casts a light on these events which illuminates their primary motivations at the time. At the time of the incident, the company knew that their new plane faced the potential issuing of formal Airworthiness Directives, which are public documents, which the manufacturers own service bulletins are not, and they are circulated automatically to the news media and other bureaus both domestic and foreign (Eddy et al., 1976, pp. 146). In the extreme case, these documents would have the power to ground the entire fleet until deemed worthy for flight by the government. The Western Region office of the FAA had jurisdiction over McDonnell Douglass manufacturing facilities, and within days of the incident, had resolved to agree with the NTSBs recommendations and had drafted an AD against the DC-10. However, the Gentlemens Agreement was negotiated the night before the draft was to be issued, thereby cutting the most involved and knowledgeable government authority out of the decision-making process. Upon feeling left out of the loop, the head of the Western Region then proposed a conference with the federal office in Washington, McDonnell Douglas, and the airlines who owned DC10s, a meeting which was subsequently led by the company and held without informing him. After being shot down twice in so short a time span, the Western Region office gave up trying to make their case (Eddy et al., 1976, pp. 151-154). At the time, this result was critical to McDonnell Douglas financially. In 1972, American airliners had firmly established their loyalties among the aircraft manufacturers, so it was necessary in this competitive business to obtain orders from foreign airlines. That summer, McDonnell Douglas was launching a large-scale round the world sales odyssey, during which they hoped to target Turkish Airlines and establish a vital presence with Middle Eastern airliners (Eddy et al., 1976, pp. 158). The stakes were so high that the goal of the company was just to fill orders, not worrying about the numbers, in order to establish new loyalties. The issuing of an AD at this juncture would have publicly cast doubt onto the companys sales focus, giving plenty of room for capitalization to the floundering Lockheed efforts before full confidence in the plane could be reinstated (Eddy et al., 1976, pp. 158). Thus, faced with the consequences of poor design which could prove detrimental to sales of the DC-10, the companys largest investment, McDonnell Douglass highest level of management successfully negotiated a lower penalty, both financially and publicly, which would ensure the planes survival. However, the managements commitment to a speedy solution seemingly ended there, for given the opportunity to responsibly correct the problem, execution of modifications was handled slowly and clumsily. Less than two years later, on March 3, 1974, Turkish Airlines Flight 981 went down.

Coping with Responsibility Reaction and Cleanup Overview In the months following the crash, the DC-10 underwent changes which would prevent similar failures from occurring. Immediately, the FAA at last issued the Airworthiness Directives which effectively ground the planes until modifications had been made to the cargo doors. These ADs did not mandate any new changes; all had originally been listed in the companys service bulletins which were issued following the Gentlemens Agreement. Later,

the FAA required that the DC-10s cabin floors be strengthened. For its part, the FAA mitigated its own flaws relatively quickly, for it made ADs stricter and more specific, banned Gentlemens Agreements, and required that floors be strengthened or vented in jumbo jets across the entire industry (Eddy et al., 1976, pp. 249, 280). McDonnell Douglas swiftly carried out these changes, and there has been no incident akin to these problems since. However, despite the attention which the cargo door and passenger floor designs received in prologue to this accident, McDonnell Douglass reactions have never particularly indicated that they have accepted full responsibility. Immediately after the crash, John Brizendine, the president of Douglas Aircraft, issued the companys official statement in response to media attention. He emphasized how McDonnell Douglas regularly had gone beyond Federal Airworthiness Regulations in designing other aspects of the plane, but that in looking at floor venting following the Windsor Incident, the company had found it to be a technically ineffective solution that would be very difficult to install in alreadydelivered planes. He re-emphasized that there existed no FARs which mandated floor venting or strengthening and recommended to the FAA that they look into amending these requirements (Fielder et al., 1992, p. 199-203). Additionally, Brizendine laid a foundation for blaming the foreign-born baggage handler who could not read the handle or peephole instructions; shortly after, Sanford McDonnell, president of the corporation, built upon this, publicly declaring the accident to have been due to human failure (Fielder et al., 1992, p. 201; Eddy et al., 1976, pp. 249-250). In the next few years during pretrial investigation and hearings, documents surfaced which made clear that the failure was not as simple as first supposed. During this process, McDonnell Douglas also attempted to pass blame on to the other involved parties. The company first charged General Dynamics for not correcting a design philosophy which it knew to be unsound, citing parts of the contract which charged the subcontractor to do so. General Dynamics refuted this, aptly claiming that there was nothing they had known which McDonnell Douglas had not, and they also noted how Convair had been left out of the modification process wherein failures, such as false certification, were directly responsible for the crash. McDonnell Douglas next contended that the FAA should be directly responsible for not imposing regulations on cabin floor venting, which they knew could help prevent the crash (Eddy et al., 1976, pp. 268-269). However, it was brought to light that since early 1971, the FAA had requested a general study on the subject from Douglas in response to concerns from the Dutch counterpart to the FAA over floor venting for the DC-10; this was something which the company had refused to venture into alone for financial reasons (Eddy et al., 1976, pp. 162, 164). Finally, McDonnell Douglas turned to Turkish Airlines, stating that the missing support plate was rendered moot since the airline had tampered with the lock pins. The airline denied the validity of this argument, claiming they did not have engineering drawings showing the correct positioning or procedures (Eddy et al., 1976, pp. 269-270). These pretrial proceedings were held in order to establish undeniably that the plane was defective and that the families of those killed were entitled to compensation. Upon reaching this decision, however, the defenses were dropped and the various suits settled without actually assigning specific blame to one or more of these parties. The unhappy cause was that the liability of McDonnell Douglas, General Dynamics, and Turkish Airlines all fell primarily on one aviation insurance syndicate, Lloyds of London. Thus the firm worked for its own interests to settle all the cases with decent speed (Eddy et al., 1976, pp. 256-257, 270). McDonnell Douglas and the DC-10 after Flight 981 Throughout the remaining history of the DC-10, numerous incidents caused the plane to continually be at the forefront of media attention. In 1979, an American Airlines DC-10 flying

out of Chicagos OHare Airport crashed during takeoff. Just as the plane began to lift off, the left pylon assembly and engine separated from the wing taking with it three feet of the wings edge. As the plane continued to climb, the loss of the engine induced a leftward roll that continued until the aircraft crashed, killing all 271 persons onboard. The NTSBs Aircraft Accident Report concluded that the cause of the pylons failure was from a maintenance procedure employed by American Airlines in which a forklift was used to support the removal of the engine and pylon it mounts to. The airline commented that the procedure was very difficult and in this instance damaged the aft bulkhead and its upper flange resulting in the detachment of the pylon from the wing (Fielder et al., 1992, pp. 208-225). Later, in 1989, a United Airlines DC-10 experienced failure of its tail mounted engine during flight. In an attempted emergency landing in Souix City, Iowa, 111 of the 296 people onboard were killed. The NTSBs report on the incident concluded that a fatigue crack in a fan disk of the tailmounted engine caused it to disintegrate. The exploding disk caused the front of the fan section to separate from the engine, sending out large amounts of shrapnel that disabled the hydraulic flight control systems. The remaining control of the two wing engines was adequate to stabilize the plane, but it was not enough to be able to successfully control all the parameters affecting landing. Therefore, the NTSB concluded that the damaged DC-10 airplane, although flyable, could not have been successfully landed on a runway (Fielder et al., 1992, pp. 247-266). Even though these two incidents were of a different nature from the crash of Flight 981, they serve as indicators of the troubled life of the McDonnell Douglas DC-10. In a submission to the Transportation, Aviation and Materials Subcommittee, Richard Livingston, director of operations for International Airline Passenger Association (IAPA), illustrated his organizations genuine and deepening concern about the DC-10 aircraft (1989, p. 308). He focused on the DC-10s history as compared to competing aircraft, noting that 3.8 percent (17 of 445) of delivered DC-10 planes have been wrecked, while only 1.2 percent of L-1011 and 1.5 percent of B-747 planes have shared the same fate (Livingston, 1989, p. 309). This statistical objectively supports the view that the DC-10 aircraft may be potentially and significantly dangerous. On August 1, 1997, McDonnell Douglas merged with Boeing to create the worlds leading aerospace company. At the time of their merger, the two companies combined to account for 78 percent of all the airline seats in the world (Boeing, 2005). Since then Boeing has continued to dominate the commercial airplane manufacturing industry and has made it their policy to bridge their excellent safety record with the new McDonnell Douglas division. Their statement of Ethical Business Conduct states that Boeing will conduct its business fairly, impartially, in an ethical and proper manner, a philosophy that if adhered to can ensure the airline industry will never experience the problems of the past (Boeing, 2005).

Conclusion As a case study, the story of Turkish Airlines Flight 981 stands as a classic example of the complex nature of most applications of ethics in engineering. No decisions are cut and dry, and no one person or critical moment may take the blame for failure. This disaster shows us how though government regulations are in place to preserve safety and fair practices, it often may not be enough to just barely adhere to the laws and strive for economic gain within those bounds. In this case which involves airline accidents that are so catastrophic and public, McDonnell Douglass actions show us the importance of being conscientious at every decision-making level throughout the life of a product, especially during the engineering process.

The crash of Flight 981 was indeed a learning experience for the entire airline industry. Seemingly small design or organizational failures in each of the private corporations, contractors, and federal agencies were exposed during the investigation following the crash, and it was found that the combination of all of these breakdowns produced disastrous results. Very importantly, the FAA received a clear view of the extent of their responsibility for the industrys safety, not just commercial success, and has since resolved the design problems involving the cargo door and passenger floor and has tightened up the remaining Federal Airworthiness Regulations in all respects. The purpose of this study has been to examine McDonnell Douglass role and decisions in each of the major stages of the breakdown. The origin of this catastrophe lay in a poor handling of design and manufacturing, and thus the company may be considered entirely responsible for allowing their defective product to reach the market. Despite decisions driven by savings at the expense of safety and faulty design philosophies in the cargo door which actually failed, a more serious problem involving the hydraulic lines in the passenger floor was continually overlooked until the crash. This was due primarily to a policy of using old design strategies which met minimum federal requirements. In addition, the company oversimplified the failure mode when confronted with it in ground testing and, being committed to their own design, were unable to recognize the root problem. Though the potential for disaster remained unrecognized during production stages, ignorance of it seemed to continue even after a mid-flight incident involving the exact same failure mode. There can be no doubt that the McDonnell Douglas engineers had sufficient technical indication of such an event, and subsequent opinions of the fuselage contractors engineers, those who knew the problem best, were essentially squelched due to closed lines of communication between Douglas and their contractor. For McDonnell Douglas, this constitutes a failure to receive external technical opinions that is consistent with that which was experienced during the design phase. Thus, when faced with financially-damaging FAA measures which would attempt to patch their design flaws, it apparently did not seem too far a stretch in safety to negotiate a less severe penalty and a slower execution of door modifications. In all likelihood, what allowed the company management to accept this risk in safety was the miscommunication of the gravity of the flaws, and so they acted to preserve the reputation of their new aircraft. Due to the intense competition within the industry, the managers were willing to employ ethically questionable tactics of cutting past the FAAs procedures in order to save themselves financially. Following the crash of Flight 981, McDonnell Douglas quickly implemented the originally-promised modifications and began to change floor designs in order to adhere with new FARs. However, in the subsequent investigation, the company did not recognize their primary liability and attempted to pin it on virtually every other involved party. The fact that the issue of liability or fault was never legally resolved is unfortunate, for it might have then incurred a company-wide examination of design policies and the ways in which they give and receive technical data and advice. As it stood at the end of this episode in the DC-10s flight record, a major design flaw had been identified and rectified, but there followed no indication that McDonnell Douglas had scrutinized and corrected their design philosophies or policies regarding financial versus safety risks, or that they intended to design past new minimum safety standards required by the FAA as they would arise. Thus the accident occurred and passed without absolute resolution, a deficiency which may have paved the way for the future accidents which continued to plague the career of the DC-10 (Eddy et al., 1976, pp. 279-281). Throughout this affair, this study has found that it is reasonable to think that McDonnell Douglas was given ample information and several opportunities in which to recognize the fundamental flaws in their product as well as their responsibility to correct them with proper initiative. To the misfortune of the passengers of Flight 981, however, at each stage the

ethically inconsistent recourses of the company appeared to be driven by the tremendous risks involved in the industry. The McDonnell Douglas Corporation has since been absorbed by their former lead competitor Boeing, and is now contributing to a company which is ethically reputable and has set the standard for aircraft production throughout the entire commercial era.

Glossary explosive decompression - sudden marked drop in the pressure of a system that occurs in less than 0.1 seconds; generally results from some sort of material fatigue or engineering failure, causing a contained system to suddenly vent into the external atmosphere (Reference.com, 2005) fuselage - main body section of an aircraft that holds crew and passengers or cargo; serves to position control and stabilization surfaces in specific relationships to lifting surfaces, required for aircraft stability and maneuverability (Reference.com, 2005) jumbo jet - a wide-body aircraft with a fuselage diameter of about 5 to 6 meters and twin aisles; typically can accommodate between 200 and 600 passengers (Reference.com, 2005) Murphy's Law - "if it can happen, it will"; a humorous axiom stating that anything that can go wrong will go wrong (Eddy et al., 1976, p. 184; Reference.com, 2005)

References Birsch, D. (1992). Whistleblowing, Ethical Obligation, and the DC-10. In Fielder, J. H., & Birsch, D. (Ed.), The DC-10 case: a study in applied ethics, technology, and society (SUNY series, case studies in applied ethics, technology, and society, pp. 161-176). Albany: State University of New York Press. Eddy, P., Potter, E., & Page, B. (1976). Destination disaster: From the Tri-Motor to the DC10. Times Newspapers, Ltd. Fielder, J. H. (1992). Floors, doors, latches, and locks. In Fielder, J. H., & Birsch, D. (Ed.), The DC-10 case: a study in applied ethics, technology, and society (SUNY series, case studies in applied ethics, technology, and society, pp. 69-81). Albany: State University of New York Press. Fielder, J. H., & Birsch, D. (Ed.). (1992). The DC-10 case: a study in applied ethics, technology, and society (SUNY series, case studies in applied ethics, technology, and society). Albany: State University of New York Press. Francillon, R. J. (1990). McDonnell Douglas since 1920 (Vol. 2). Annapolis, MD: Naval Institute Press. (Original work published 1979). French, P. (1982). What is Hamlet to McDonnell Douglas or McDonnell Douglas to Hamlet?: DC-10. In Fielder, J. H., & Birsch, D. (Ed.), The DC-10 case: a study in applied ethics, technology, and society (SUNY series, case studies in applied ethics, technology, and society,

pp. 177-192). Albany: State University of New York Press. History & Ethics and business conduct. (2005). General Info. Retrieved November 15, 2005, from Boeing Aircraft Company Web site: http://www.boeing.com/companyoffices/aboutus/flash.html Johnston, M. (1976). The last nine minutes: The story of flight 981. New York: William Morrow and Company, Inc. Livingston, Richard E. (1989). International Airline Passengers Association Critique of the DC-10. In Fielder, J. H., & Birsch, D. (Ed.), The DC-10 case: a study in applied ethics, technology, and society (SUNY series, case studies in applied ethics, technology, and society, pp. 307-313). Albany: State University of New York Press. Newhouse, J. (1982). High risks, sinking fortunes. In Fielder, J. H., & Birsch, D. (Ed.), The DC-10 case: a study in applied ethics, technology, and society (SUNY series, case studies in applied ethics, technology, and society, pp. 55-67). Albany: State University of New York Press. Reference.com. (2005). Retrieved December 8, 2005, from http://www.reference.com/ Schlager, N. (Ed.). (1994). When technology fails: significant technological disasters, accidents, and failures of the twentieth century. Detroit: Gale Research Inc. Sewell, H. (1982). Commentary. In Fielder, J. H., & Birsch, D. (Ed.), The DC-10 case: a study in applied ethics, technology, and society (SUNY series, case studies in applied ethics, technology, and society, pp. 193-198). Albany: State University of New York Press. Sharkey, J. (2001, August 15). Business Travel; The low-fare airlines fly profitably above the turmoil as the giants struggle with the downturn. The New York Times. Retrieved November 15, 2005, from http://select.nytimes.com/gst/abstract.html?res=FA0E17F63D5A0C768DDDA10894D94044 82 Unger, S. H. (1982). Controlling technology: Ethics and the responsible engineer. Holt, Rinehart, and Winston, Inc. Vesilind, P. A. (2001, October). Engineering as applied social science. Journal of Professional Issues in Engineering Education and Practice, 127, 184-188. ASCE Journals database. http://www.pubs.asce.org/journals/jrns.html (25 September 2005).